@ai-workbench/remote-agent 0.8.5 → 0.8.10

package/dist/index.js

@@ -3,7 +3,7 @@ import Schema from '@deepseek-ai/schemastery';
 import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
 import { fileURLToPath } from 'node:url';
 import { createHash, randomUUID } from 'node:crypto';
-import { recoveryJournal, recoveryKey } from "./recovery.js";
+import { recoveryJournal, runtimeRecoveryKey, supportsCodexContextPolicy } from "./recovery.js";
 import * as unstable from '@agentclientprotocol/sdk/unstable';
 import * as acp from '@agentclientprotocol/sdk';
 import { AcpSession } from "./acp.js";
@@ -12,7 +12,7 @@ import { StreamMapper } from "./mapping.js";
 import { connectProvider } from "./provider.js";
 import { brokerFactory } from "./broker.js";
 import { AGENTS, CODEX_AGENT } from "./agents.js";
-import { prepareInput } from "./input.js";
+import { prepareInput, prepareContinuation } from "./input.js";
 import { createWorkspaceNoticeConsumer, isWorkspaceNoticeMessage } from "./workspace-notice.js";
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
@@ -23,12 +23,18 @@ import { StageTiming } from "./stage-timing.js";
 import { verifyRecoveryCheckpoint, currentInputIds } from "./recovery-checkpoint.js";
 import { ModelCatalog, modelInfo } from "./model-catalog.js";
 import { ModelConfigurationError } from "./model-configuration.js";
+import { officialEmployeeWorkspace } from "./employee-workspace.js";
+import { resolveEmployeeNative } from "./employee-native.js";
+import { createLocalUserTurnObserver } from "./local-user-turn.js";
+import { createClaudeLocalProvider } from "./claude-local.js";
+import { readLocalUserTurn } from "./local-user-turn.js";
+import { readEmployeeWorkspace } from "./employee-workspace.js";
 export const name = 'ai-workbench-remote-agent';
 export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never' });
+export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000 });
 export const Config = Schema.object({
     mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
@@ -36,11 +42,13 @@ export const Config = Schema.object({
     brokerControlMaxBytes: Schema.number().min(1).step(1).i18n({ en: 'Host session control reply limit; default 1 MiB, adjustable by administrators', zh: '主机会话管理回复容量；默认1 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerControlMaxBytes).volatile(),
     oneShotSandbox: Schema.union(['read-only', 'workspace-write', 'danger-full-access']).i18n({ en: 'One-shot sandbox; workspace changes are allowed by default', zh: '单次任务沙箱；默认允许工作区内修改' }).default(DEFAULT_CONFIG.oneShotSandbox).volatile(),
     oneShotApproval: Schema.const('never').i18n({ en: 'Non-interactive approval; permissions follow the launch policy, never automatic approval', zh: '单次模式无交互审批；权限由启动策略决定，不表示自动批准' }).default(DEFAULT_CONFIG.oneShotApproval).volatile(),
+    employeeShellKillGraceMs: Schema.number().min(0).max(2147483647).step(1).i18n({ en: 'Local command SSH cleanup grace in milliseconds; cancellation keeps the remote result unknown', zh: '本机命令SSH取消后的清理宽限毫秒；默认1000，取消仍保留员工端结果未知' }).default(DEFAULT_CONFIG.employeeShellKillGraceMs).volatile(),
 });
 /** DSH volatile settings are handles; adapters freeze their values once per invocation. */
 export function readConfig(config) {
     return Object.fromEntries(Object.entries(config).map(([key, value]) => [key, typeof value === 'object' && value !== null && 'get' in value ? value.get() : value]));
 }
+function validContextDigest(value) { return typeof value === 'string' && /^[a-fA-F0-9]{64}$/u.test(value); }
 function readPointer(options, agent) {
     const last = options.messages.findLast(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
     if (!last || last.role !== 'assistant')
@@ -53,6 +61,8 @@ function readPointer(options, agent) {
         throw new NeedError('SESSION_STATE_INVALID', '原对话缺少新版工作区/模型绑定，不能静默迁移，请新建会话', '有效的新一代远端会话恢复记录');
     if (options.sessionId && pointer.dshSessionId !== options.sessionId)
         throw new NeedError('SESSION_CONTEXT_MISMATCH', '此恢复记录属于另一会话，复制或分叉后不能沿用原远端进程，请新建会话', '当前DSH会话自己的远端恢复记录');
+    if (agent.loginProvider === 'codex' && (!validContextDigest(pointer.contextSha256) || (pointer.previousRemoteSessions !== undefined && (!Array.isArray(pointer.previousRemoteSessions) || !pointer.previousRemoteSessions.every(ref => ref && typeof ref.sessionId === 'string' && ref.sessionId.length > 0 && validContextDigest(ref.contextSha256))))))
+        throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '原Codex会话的初建上下文摘要未知或无效，不能猜测是否相同，本轮未发送', '原会话合法的64位十六进制初建上下文摘要');
     return pointer;
 }
 export class CodexRemoteAdapter extends LlmAdapter {
@@ -101,6 +111,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
     } }
     async invalidateModelState() { for (const turn of this.turns.values())
         turn.abort(); await Promise.all([...this.sessions.keys()].map(id => this.disposeSession(id))); }
+    async invalidateEmployeeState() { await Promise.all([...this.sessions].filter(([, live]) => live.runtime.employeeExecutionMeta || live.runtime.execution).map(([id]) => this.disposeSession(id))); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     cleanupRuntime(runtime) {
         const existing = this.cleanups.get(runtime);
@@ -165,7 +176,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 throw new LlmError(error.message, error.code, { cause: error });
             if (error instanceof NeedError) {
                 const rpc = /RPC 错误码 (-?\d+)/u.exec(error.requires)?.[1];
-                const message = employeeFailure(error.code) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
+                const message = employeeFailure(error.code, this.agent.loginProvider) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
                 let diagnostic = error.technical ? JSON.stringify(error.technical) : '';
                 if (error.technical && this.reportLoginFailure) {
                     try {
@@ -200,6 +211,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         let live;
         let succeeded = false;
         let remoteAttempted = false;
+        let preserveRecoveredRuntime = false;
         let activeMapper;
         let catalog;
         let selected;
@@ -221,18 +233,34 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 throw new NeedError('SESSION_STATE_UNCONFIRMED', '上轮远端状态未确认，不能自动重发或重开，请新建会话并核对项目', '管理员核对原会话状态');
             if (live && !previous)
                 throw new NeedError('SESSION_STATE_MISSING', '上一轮回复尚无持久恢复记录，不能继续当前远端会话', '原会话的持久回复记录');
-            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes]);
+            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
             if (live && live.configuration !== configuration)
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '会话运行设置已改变，请新建会话', '原会话运行设置');
             const request = { timing, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) };
+            const after = options.messages.findLastIndex(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
+            request.userInputIds = Object.freeze(options.messages.slice(after + 1).flatMap(message => message.role === 'user' && message.source?.kind === 'user' && typeof message.id === 'string' ? [message.id] : []));
+            request.userMessageIds = request.userInputIds;
             await this.resolveRuntime.preflight?.(request);
-            const input = await timing.run('input-prepare', () => prepareInput(options, this.readImage));
+            let input = await timing.run('input-prepare', () => prepareInput(options, this.readImage));
             const contextSha256 = createHash('sha256').update(input.systemPrompt ?? '').digest('hex');
             request.contextSha256 = contextSha256;
+            const codex = this.agent.loginProvider === 'codex';
+            if (codex && live && previous && live.contextSha256 !== previous.contextSha256.toLowerCase())
+                throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '持久上下文摘要与当前远端会话的初建摘要不一致，本轮未发送', '原会话一致的初建上下文摘要');
+            const contextChanged = !!previous && codex && previous.contextSha256.toLowerCase() !== contextSha256;
+            // Only identical durable context can prove a legacy context-bound journal.
+            // New Codex transport scopes are independent of the native context digest.
+            if (contextChanged)
+                request.contextSha256 = undefined;
             if (previous && this.agent.loginProvider === 'claude' && previous.contextSha256 !== contextSha256)
                 throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
+            if (contextChanged)
+                input = await prepareContinuation(options, input, this.readImage);
             if (live) {
-                live.session.validateContext({ systemPrompt: input.systemPrompt });
+                if (contextChanged)
+                    live.session.validateNewSessionContext({ systemPrompt: input.systemPrompt });
+                else
+                    live.session.validateContext({ systemPrompt: input.systemPrompt });
                 live.session.validatePrompt(input.prompt);
             }
             if (mode === 'one-shot' && (input.systemPrompt || input.prompt.some(block => block.type !== 'text')))
@@ -241,36 +269,60 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
             if (mode === 'one-shot')
                 throw new NeedError('MODEL_CONFIGURATION_UNSUPPORTED', '单次模式不支持确认当前模型与推理等级，请改用会话模式', '支持模型配置确认的会话模式');
+            request.localAdmissionCheck?.();
             catalog = await this.catalog(signal);
             selected = catalog.models.find(model => model.id === options.model);
             if (!selected)
                 throw new ModelConfigurationError('所选模型不在本次可信主机目录中，请重新选择模型');
             if (options.reasoningEffort !== undefined && !selected.reasoning.options.some(option => option.value === options.reasoningEffort))
                 throw new ModelConfigurationError('所选推理等级不在本次模型目录中');
-            const modelSignal = AbortSignal.any([signal, catalog.signal]);
+            let modelSignal = AbortSignal.any([signal, catalog.signal]);
             options.signal = modelSignal;
             request.signal = modelSignal;
             runtime = await this.resolveRuntime(request);
             signal.throwIfAborted();
+            if (runtime.execution?.signal) {
+                modelSignal = AbortSignal.any([modelSignal, runtime.execution.signal]);
+                options.signal = modelSignal;
+                request.signal = modelSignal;
+                modelSignal.throwIfAborted();
+            }
             catalog.assertCurrent();
             if (runtime.connection && (runtime.connection.instanceId !== catalog.target.instanceId || runtime.connection.epoch !== catalog.target.epoch) || runtime.identity !== `${catalog.target.target.username}@${catalog.target.target.host}:${catalog.target.target.port}`)
                 throw new ModelConfigurationError('模型目录与当前会话可信员工主机不一致');
             if (previous && (previous.identity !== runtime.identity || previous.cwd !== runtime.cwd || previous.bindingId && previous.bindingId !== runtime.binding?.bindingId || previous.workspaceId && previous.workspaceId !== runtime.binding?.workspaceId))
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '原会话的员工主机或工作区已改变，请新建会话', '原会话的可信目标和工作区');
+            if (contextChanged && runtime.recoveredSession) {
+                const capabilities = runtime.recoveredSession.capabilities;
+                // A clean reattach has sent no ACP input. A known policy refusal must
+                // detach it, preserving the original native session and checkpoint.
+                if (!capabilities.sessionCapabilities?.systemPrompt || !supportsCodexContextPolicy(capabilities)) {
+                    preserveRecoveredRuntime = true;
+                    if (!capabilities.sessionCapabilities?.systemPrompt)
+                        throw new NeedError('SYSTEM_PROMPT_UNSUPPORTED', '远端未声明系统与开发者上下文能力，不能丢弃这些要求继续', '支持 systemPrompt 的公开 ACP 能力');
+                    throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '远端没有明确声明Codex上下文仅新建生效的兼容政策，本轮未发送', 'systemPrompt与精确的aiWorkbenchSystemPrompt新建政策');
+                }
+            }
             if (runtime.restartNotice) {
                 const ids = runtime.restartInputIds;
                 if (!ids?.length || new Set(ids).size !== ids.length || ids.some(id => input.users.filter(u => u.id === id).length !== 1))
                     throw new NeedError('CURRENT_INPUT_UNCONFIRMED', '无法核对本次输入，尚未发送给模型', '官方当前步骤的已接纳用户输入');
-                input.prompt = ids.flatMap(id => input.users.find(u => u.id === id).prompt);
+                input = { ...input, prompt: ids.flatMap(id => input.users.find(u => u.id === id).prompt) };
+                if (contextChanged)
+                    input = await timing.run('input-prepare', () => prepareContinuation(options, input, this.readImage));
             }
             const details = runtime.details;
             if (!details)
                 throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。', 'L技术详情持久接收能力');
             timing.bind(detail => details.record(detail));
-            const mapper = new StreamMapper(mode === 'session' ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
+            const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
             activeMapper = mapper;
             let id;
             let stop;
+            if (runtime.employeePresentation) {
+                yield* mapper.text(runtime.employeePresentation + '\n\n');
+                yield* mapper.flush();
+            }
             if (runtime.workspaceNotice) {
                 yield* mapper.text(runtime.workspaceNotice.text);
                 yield* mapper.flush();
@@ -279,6 +331,11 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 yield* mapper.text(runtime.restartNotice + '\n\n');
                 yield* mapper.flush();
             }
+            if (runtime.execution) {
+                details.record({ kind: 'session', severity: 'warning', code: 'CLAUDE_EMPLOYEE_SCOPE', summary: '本机工具路由及未覆盖操作范围', payload: runtime.execution.scope });
+                yield* mapper.text(runtime.execution.notice + '\n\n');
+                yield* mapper.flush();
+            }
             if (mode === 'session') {
                 if (live && live.runtime !== runtime)
                     throw new NeedError('SESSION_TRANSPORT_MISMATCH', '原会话的主机通道已更换，不能自动切换进程', '原主机会话通道');
@@ -289,7 +346,22 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let done = false;
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
-                const hooks = { broker: runtime.broker, timing, approve: (permission, approvalSignal) => this.approve?.(permission, approvalSignal, options) ?? Promise.resolve('unavailable'), onUpdate: notification => { try {
+                const hooks = { broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
+                        const execution = runtime.execution;
+                        const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
+                        if (execution) {
+                            if (toolName && ['Agent', 'Task', 'TaskOutput', 'TaskStop', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash'].includes(toolName)) {
+                                details.record({ kind: 'need', severity: 'warning', code: 'CLAUDE_HOST_TOOL_UNSUPPORTED', summary: '这类原生调用没有经过员工端别名，本机来源不支持；本次审批已取消', payload: { operation: toolName } });
+                                push(mapper.text('\n这类操作尚不支持在本机执行，已取消本次审批，没有在主机代跑。\n'));
+                                return 'cancelled';
+                            }
+                            await execution.validate(approvalSignal);
+                        }
+                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined) ?? 'unavailable';
+                        if (execution && answer === 'allowed-once')
+                            await execution.validate(approvalSignal);
+                        return answer;
+                    }, onUpdate: notification => { try {
                         push(mapper.acp(notification.update));
                     }
                     catch (error) {
@@ -300,7 +372,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (fresh) {
                     const transport = runtime.acpTransport instanceof acp.AgentApp || runtime.acpTransport instanceof unstable.AgentApp ? runtime.acpTransport : acp.ndJsonStream(runtime.acpTransport.writable, runtime.acpTransport.readable, { maxMessageBytes: config.acpMaxMessageBytes });
                     session = new AcpSession(transport, hooks);
-                    live = { session, runtime, configuration, usageSnapshot: mapper.usageSnapshot };
+                    live = { session, runtime, configuration, contextSha256, usageSnapshot: mapper.usageSnapshot };
                     if (key)
                         this.sessions.set(key, live);
                 }
@@ -313,17 +385,30 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 const task = (async () => {
                     remoteAttempted = true;
                     try {
-                        if (fresh) {
-                            if (runtime.recoveredSession)
-                                session.restore(runtime.cwd, runtime.recoveredSession, { systemPrompt: input.systemPrompt });
-                            else
-                                await session.start(runtime.cwd, runtime.restartNotice ? undefined : previous?.sessionId, modelSignal, { systemPrompt: input.systemPrompt });
+                        if (fresh && runtime.recoveredSession) {
+                            if (previous && runtime.recoveredSession.sessionId !== previous.sessionId)
+                                throw new NeedError('SESSION_STATE_INVALID', '已接回的会话与持久标识不一致，本轮未发送', '原会话的恢复标识');
+                            session.restore(runtime.execution?.hostCwd ?? runtime.cwd, runtime.recoveredSession, { systemPrompt: input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}) }, codex && !!previous && !contextChanged);
+                            session.validatePrompt(input.prompt);
+                            if (contextChanged)
+                                await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
                         }
+                        else if (fresh)
+                            await session.start(runtime.execution?.hostCwd ?? runtime.cwd, contextChanged || runtime.restartNotice ? undefined : previous?.sessionId, modelSignal, { systemPrompt: contextChanged ? (input.systemPrompt ?? '') : input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
+                        else if (contextChanged)
+                            await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
                         else {
                             const updated = await session.updateContext({ systemPrompt: input.systemPrompt }, modelSignal);
                             if (updated && this.agent.loginProvider === 'claude')
                                 throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
                         }
+                        if (contextChanged) {
+                            if (session.id === previous.sessionId)
+                                throw new NeedError('SESSION_STATE_INVALID', '新会话标识与原会话相同，无法确认独立承接，本轮未发送', '独立的新远端会话标识');
+                            live.contextSha256 = contextSha256;
+                            live.usageSnapshot = mapper.usageSnapshot;
+                            details.record({ kind: 'session', severity: 'info', code: 'CODEX_CONTEXT_SESSION_REPLACED', summary: 'Codex要求仅在新建生效，已保留原会话；新会话承接可见用户及助手正文，内部推理不转发', payload: { reason: 'system-context-changed', oldSessionId: previous.sessionId, newSessionId: session.id, oldContextSha256: previous.contextSha256, newContextSha256: contextSha256, history: input.historyTransfer } });
+                        }
                         catalog.assertCurrent();
                         const actual = await session.selectModel(selected.value, options.reasoningEffort, modelSignal);
                         catalog.assertCurrent();
@@ -350,11 +435,16 @@ export class CodexRemoteAdapter extends LlmAdapter {
                     details.beginTurn(runtime.detailContext?.() ?? { turn: null, step: null });
                     catalog.assertCurrent();
                     session.assertModelSelection(selected.value, options.reasoningEffort);
+                    await runtime.execution?.beginTurn(modelSignal);
                     id = session.id;
                     try {
-                        return await session.prompt(input.prompt, modelSignal);
+                        const result = await session.prompt(input.prompt, modelSignal);
+                        if (contextChanged)
+                            push(mapper.text(runtime.restartNotice ? '\n\n会话要求已变化，已把此前可见对话带入新 Codex 会话继续处理。' : '\n\n会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。'));
+                        return result;
                     }
                     finally {
+                        runtime.execution?.endTurn();
                         details.endTurn();
                     }
                 })();
@@ -406,7 +496,8 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (await runtime.saveCheckpoint(id, session.checkpoint))
                     recoveryCheckpointId = id;
             }
-            const pointer = { ...(modelConfiguration ? { modelConfiguration } : {}), ...(recoveryCheckpointId ? { recoveryCheckpointId } : {}), ...(runtime.workspaceNotice ? { presentation: { workspaceNotice: runtime.workspaceNotice } } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
+            const previousRemoteSessions = [...(previous?.previousRemoteSessions ?? []), ...(contextChanged ? [{ sessionId: previous.sessionId, contextSha256: previous.contextSha256 }] : [])];
+            const pointer = { ...(previousRemoteSessions.length ? { previousRemoteSessions } : {}), ...(modelConfiguration ? { modelConfiguration } : {}), ...(recoveryCheckpointId ? { recoveryCheckpointId } : {}), ...(runtime.workspaceNotice ? { presentation: { workspaceNotice: runtime.workspaceNotice } } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
             succeeded = true;
             yield { type: 'finish', reason: { kind: stop === 'max_tokens' || stop === 'max_turn_requests' ? 'max-tokens' : 'stop' }, replayState: { response: pointer } };
         }
@@ -427,9 +518,10 @@ export class CodexRemoteAdapter extends LlmAdapter {
             throw error;
         }
         finally {
+            runtime?.execution?.endTurn();
             catalog?.release();
             try {
-                if (this.shuttingDown || key && this.detached.has(key)) {
+                if (preserveRecoveredRuntime || this.shuttingDown || key && this.detached.has(key)) {
                     session?.close();
                     await runtime?.detach?.();
                 }
@@ -459,6 +551,7 @@ export class RemoteAgentsAdapter extends LlmAdapter {
     listModels(provider) { return this.adapter(provider).listModels(provider); }
     resolveModel(provider, model, signal) { return this.adapter(provider).resolveModel(provider, model, signal); }
     async invalidateModelState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateModelState())); }
+    async invalidateEmployeeState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateEmployeeState())); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     stream(options) { return this.adapter(options.provider).stream(options); }
     async disposeSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.disposeSession(sessionId))); }
@@ -476,6 +569,7 @@ export function apply(ctx, live) {
         return attachments.readImage(ref, signal);
     };
     const openByAgent = new Map(AGENTS.map(agent => [agent.id, brokerFactory(get, undefined, config)]));
+    const localTurns = createLocalUserTurnObserver(ctx);
     const detailManagers = new Map();
     const managerForProfile = () => {
         const profile = ctx.get('profileContext');
@@ -490,13 +584,15 @@ export function apply(ctx, live) {
     };
     let changed = () => { };
     const modelDirectory = new ModelCatalog(get, () => config().acpMaxMessageBytes, undefined, () => changed());
-    const adapter = new RemoteAgentsAdapter(config, agent => connectProvider(get, { agent, notice: createWorkspaceNoticeConsumer(ctx, agent), details: async (request, api, connection, target) => {
-            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection });
-        }, open: async (...args) => {
+    const adapter = new RemoteAgentsAdapter(config, agent => {
+        const details = async (request, api, connection, target) => {
+            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection, localAcceptanceId: request.localAcceptanceId ?? request.localAcceptance?.acceptanceId });
+        };
+        const open = async (...args) => {
             const profile = ctx.get('profileContext');
             if (!profile?.dir)
                 throw new NeedError('RECOVERY_STORAGE_REQUIRED', '会话恢复需要官方profile目录', '官方profileContext.dir');
-            args[2].recoveryJournal = recoveryJournal(profile.dir, recoveryKey([`${args[0].username}@${args[0].host}:${args[0].port}`, agent.id, args[2].sessionId]));
+            args[2].recoveryJournal = recoveryJournal(profile.dir, runtimeRecoveryKey(`${args[0].username}@${args[0].host}:${args[0].port}`, agent.id, args[2].sessionId, args[2].employeeScope));
             args[2].verifyRecovery = () => verifyRecoveryCheckpoint(ctx, args[2], agent.id);
             args[2].currentInputIds = await currentInputIds(ctx, args[2]);
             const runtime = await openByAgent.get(agent.id)(...args);
@@ -520,7 +616,19 @@ export function apply(ctx, live) {
                 return { turn, step };
             };
             return runtime;
-        } }), dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
+        };
+        const local = agent.loginProvider === 'claude' ? createClaudeLocalProvider({ getConnect: get, getNetwork: () => ctx.get('aiWorkbenchNetwork'), readWorkspace: id => readEmployeeWorkspace(ctx, id), readUserTurn: request => readLocalUserTurn(ctx, { sessionId: request.sessionId, route: agent.id, userMessageIds: request.userMessageIds ?? [] }), reportAdmissionFailure: (request, code) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: 'claude', code }), recordUnscoped: (request, observation) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: 'claude', code: observation.code, observation }), configuration: config, details, open }) : undefined;
+        return connectProvider(get, { agent, ...(agent.loginProvider === 'codex' ? { employee: {
+                    currentUserTurn: request => localTurns.current(request),
+                    getNetwork: () => ctx.get('aiWorkbenchNetwork'),
+                    workspace: async (request) => {
+                        const services = ctx;
+                        const registry = services.get('workspaceRegistry');
+                        const sessions = services.get('sessions');
+                        return officialEmployeeWorkspace(request.sessionId, registry, sessions?.get(request.sessionId)?.header);
+                    }, native: () => resolveEmployeeNative(),
+                } } : {}), notice: createWorkspaceNoticeConsumer(ctx, agent), details, open, local });
+    }, dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
         const events = sessionId ? ctx.get('agents')?.get(SessionId(sessionId))?.session.snapshotEvents() : undefined;
         let turn = null, step = null;
         for (const event of events ?? []) {
@@ -544,8 +652,20 @@ export function apply(ctx, live) {
     const directory = ctx.llm.registerConfigurableProviders(entries());
     const registration = ctx.llm.registerAdapter(ids, adapter);
     changed = () => { registration.replace(ids); void adapter.invalidateModelState().catch(() => { ctx.logger('remote-agent').warn('原会话清理结果未确认，已阻断继续发送；请联系管理员核对。'); }); };
-    ctx.on('internal/service', service => { if (service === 'aiWorkbenchConnect')
-        modelDirectory.refresh(); });
+    const serviceValue = (name) => ctx.get(name);
+    let employeeConnect = serviceValue('aiWorkbenchConnect'), employeeNetwork = serviceValue('aiWorkbenchNetwork');
+    ctx.on('internal/service', service => {
+        if (service === 'aiWorkbenchConnect')
+            modelDirectory.refresh();
+        if (service !== 'aiWorkbenchConnect' && service !== 'aiWorkbenchNetwork')
+            return;
+        const nextConnect = serviceValue('aiWorkbenchConnect'), nextNetwork = serviceValue('aiWorkbenchNetwork');
+        if (nextConnect === employeeConnect && nextNetwork === employeeNetwork)
+            return;
+        employeeConnect = nextConnect;
+        employeeNetwork = nextNetwork;
+        void adapter.invalidateEmployeeState().catch(() => { ctx.logger('remote-agent').warn('本机执行连接的清理结果未确认，已阻断继续发送；请联系管理员核对。'); });
+    });
     new ProviderLocaleRemote(ctx, next => { language = next; directory.replace(entries()); registration.replace(ids); });
     const cleanup = (id) => adapter.detachSession(id);
     ctx.on('agent/disposed', ({ agent }) => cleanup(agent.session.id));
@@ -558,7 +678,7 @@ export function dshApproval(ctx) {
         const approval = ctx.get('approval');
         if (!agent || !approval)
             return 'unavailable';
-        const label = approvalLabel(request);
+        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host');
         if (!label)
             return 'unavailable';
         return approval.request({ agent, ...label, signal });

package/dist/input.d.ts

@@ -4,6 +4,14 @@ export type ImageReader = (ref: ImageBlock['attachment'], signal?: AbortSignal)
     ref: ImageBlock['attachment'];
     data: Uint8Array;
 }>;
+export interface HistoryTransfer {
+    scope: 'visible-user-assistant-text-and-images';
+    textBlocks: number;
+    imageBlocks: number;
+    offloadedImagePlaceholders: number;
+    omittedReasoningBlocks: number;
+    reasoningOmissionReason: 'dsh-internal-reasoning';
+}
 export interface PreparedInput {
     prompt: AcpContentBlock[];
     users: {
@@ -11,6 +19,9 @@ export interface PreparedInput {
         prompt: AcpContentBlock[];
     }[];
     systemPrompt?: string;
+    historyTransfer?: HistoryTransfer;
 }
+/** Role-labelled public history only; never serialize source/replay/tool internals. */
+export declare function prepareContinuation(options: GenerateOptions, input: PreparedInput, readImage?: ImageReader): Promise<PreparedInput>;
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export declare function prepareInput(options: GenerateOptions, readImage?: ImageReader): Promise<PreparedInput>;

package/dist/input.js

@@ -1,5 +1,59 @@
 import { NeedError } from "./remote.js";
 import { isWorkspaceNoticeMessage, withoutWorkspaceNotice } from "./workspace-notice.js";
+async function publicBlock(block, options, readImage, history = false) {
+    options.signal?.throwIfAborted();
+    if (block.type === 'text')
+        return { type: 'text', text: block.text };
+    if (block.type === 'image') {
+        if (block.offloaded) {
+            return { type: 'text', text: `图片 ${block.attachment.name ?? block.attachment.attachmentId} 已按官方会话策略移出当前上下文。` };
+        }
+        if (!readImage)
+            throw new NeedError('ATTACHMENT_REQUIRED', '我需要官方附件组件读取这张图片', '官方attachments.readImage');
+        const image = await readImage(block.attachment, options.signal);
+        options.signal?.throwIfAborted();
+        if (!image || !(image.data instanceof Uint8Array) || image.ref?.attachmentId !== block.attachment.attachmentId || !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(image.ref.mediaType) || image.ref.bytes !== image.data.byteLength)
+            throw new NeedError('ATTACHMENT_INVALID', '图片附件没有返回匹配的已核验内容', '官方核验的图片字节与媒体类型');
+        return { type: 'image', mimeType: image.ref.mediaType, data: Buffer.from(image.data).toString('base64') };
+    }
+    throw new NeedError(history ? 'HISTORY_CONTENT_UNSUPPORTED' : 'INPUT_TYPE_REQUIRED', `我需要此${history ? '历史' : '输入'}类型的远程转接能力：${block.type}；本轮未新建或发送`, '对应类型的公开ACP输入映射；内部推理及工具记录不可降为用户要求');
+}
+/** Role-labelled public history only; never serialize source/replay/tool internals. */
+export async function prepareContinuation(options, input, readImage) {
+    const messages = options.messages.filter(message => !isWorkspaceNoticeMessage(message)).map(withoutWorkspaceNotice);
+    for (const message of messages)
+        if (!['user', 'assistant', 'system', 'developer'].includes(message.role))
+            throw new NeedError('HISTORY_CONTENT_UNSUPPORTED', `此前含有无法可靠承接的历史角色：${message.role}；本轮未新建或发送`, '完整公开的用户及助手历史；工具记录的公开内容映射');
+    const after = messages.findLastIndex(message => message.role === 'assistant');
+    const prompt = [];
+    const historyTransfer = { scope: 'visible-user-assistant-text-and-images', textBlocks: 0, imageBlocks: 0, offloadedImagePlaceholders: 0, omittedReasoningBlocks: 0, reasoningOmissionReason: 'dsh-internal-reasoning' };
+    for (const message of messages.slice(0, after + 1)) {
+        if (message.role === 'system' || message.role === 'developer')
+            continue;
+        if (message.role !== 'user' && message.role !== 'assistant')
+            throw new NeedError('HISTORY_CONTENT_UNSUPPORTED', `此前含有无法可靠承接的历史角色：${message.role}；本轮未新建或发送`, '完整公开的用户及助手历史；工具记录的公开内容映射');
+        prompt.push({ type: 'text', text: `此前可见对话（历史角色：${message.role}；仅为历史记录）：\n` });
+        for (const block of message.content) {
+            // DSH explicitly distinguishes internal thinking from visible user text.
+            if (block.type === 'reasoning') {
+                historyTransfer.omittedReasoningBlocks++;
+                continue;
+            }
+            prompt.push(await publicBlock(block, options, readImage, true));
+            if (block.type === 'text')
+                historyTransfer.textBlocks++;
+            else if (block.type === 'image') {
+                if (block.offloaded)
+                    historyTransfer.offloadedImagePlaceholders++;
+                else
+                    historyTransfer.imageBlocks++;
+            }
+        }
+        prompt.push({ type: 'text', text: `\n（历史角色：${message.role} 的记录结束）\n` });
+    }
+    prompt.push({ type: 'text', text: '此前可见对话结束。以下为当前用户输入：\n' }, ...input.prompt);
+    return { ...input, prompt, historyTransfer };
+}
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export async function prepareInput(options, readImage) {
     options.signal?.throwIfAborted();
@@ -10,7 +64,11 @@ export async function prepareInput(options, readImage) {
     for (const message of messages) {
         if (message.role !== 'system' && message.role !== 'developer')
             continue;
-        const parts = message.content.map(block => block.type === 'text' ? block.text : JSON.stringify(block));
+        const parts = message.content.map(block => {
+            if (block.type !== 'text')
+                throw new NeedError('SYSTEM_CONTEXT_TYPE_UNSUPPORTED', '系统或开发者要求包含暂不支持的非文本内容，本轮未新建或发送', '系统及开发者仅支持公开text上下文；非文本内容需要已定义的公开ACP投影');
+            return block.text;
+        });
         if (parts.length)
             context.push((message.role === 'system' ? '系统上下文：' : '开发者上下文：') + '\n' + parts.join('\n'));
     }
@@ -22,28 +80,8 @@ export async function prepareInput(options, readImage) {
     const preparedUsers = [];
     for (const message of users) {
         const before = prompt.length;
-        for (const block of message.content) {
-            options.signal?.throwIfAborted();
-            if (block.type === 'text') {
-                prompt.push({ type: 'text', text: block.text });
-                continue;
-            }
-            if (block.type === 'image') {
-                if (block.offloaded) {
-                    prompt.push({ type: 'text', text: `图片 ${block.attachment.name ?? block.attachment.attachmentId} 已按官方会话策略移出当前上下文。` });
-                    continue;
-                }
-                if (!readImage)
-                    throw new NeedError('ATTACHMENT_REQUIRED', '我需要官方附件组件读取这张图片', '官方attachments.readImage');
-                const image = await readImage(block.attachment, options.signal);
-                options.signal?.throwIfAborted();
-                if (!image || !(image.data instanceof Uint8Array) || image.ref?.attachmentId !== block.attachment.attachmentId || !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(image.ref.mediaType) || image.ref.bytes !== image.data.byteLength)
-                    throw new NeedError('ATTACHMENT_INVALID', '图片附件没有返回匹配的已核验内容', '官方核验的图片字节与媒体类型');
-                prompt.push({ type: 'image', mimeType: image.ref.mediaType, data: Buffer.from(image.data).toString('base64') });
-                continue;
-            }
-            throw new NeedError('INPUT_TYPE_REQUIRED', `我需要此输入类型的远程转接能力：${block.type}`, '对应类型的公开ACP输入映射');
-        }
+        for (const block of message.content)
+            prompt.push(await publicBlock(block, options, readImage));
         preparedUsers.push({ id: message.id, prompt: prompt.slice(before) });
     }
     if (!prompt.length)

package/dist/local-user-turn.d.ts

@@ -0,0 +1,24 @@
+import type { RuntimeRequest } from './provider.ts';
+import type { Context } from '@deepseek-ai/cordis';
+export interface LocalTurnProof {
+    expectedUserTurn: {
+        turn: number;
+        userMessageId: string;
+    };
+    startSequence: number;
+    userMessageSequence: number;
+    assertCurrent(): void;
+}
+/** CAS expectation only. L independently establishes live human-turn/brand evidence. */
+export declare function readLocalUserTurn(ctx: Context, request: {
+    sessionId: string;
+    route: string;
+    userMessageIds: readonly string[];
+}): Promise<LocalTurnProof>;
+/** Only metadata observed live since this plugin mounted; never seed or persisted tails. */
+export declare function createLocalUserTurnObserver(ctx: Pick<Context, 'get' | 'on'>): {
+    current(request: Pick<RuntimeRequest, "sessionId" | "userInputIds">): {
+        turn: number;
+        userMessageId: string;
+    };
+};